JVN#21369452
Installers of Lhaz and Lhaz+, and Self-Extracting Archives created by Lhaz or Lhaz+ may insecurely load Dynamic Link Libraries

Overview

Installers of Lhaz and Lhaz+, and Self-extracting archive files created by Lhaz or Lhaz+ may insecurely load Dynamic Link Libraries.

Products Affected

• Installer of Lhaz version 2.4.0 and earlier - CVE-2017-2246
• Self-extracting archive files created by Lhaz version 2.4.0 and earlier - CVE-2017-2247
• Installer of Lhaz+ version 3.4.0 and earlier - CVE-2017-2248
• Self-extracting archive files created by Lhaz+ version 3.4.0 and earlier - CVE-2017-2249

Description

Lhaz and Lhaz+ provided by Chitora soft contain the following vulnerabilities.

• Installers of Lhaz and Lhaz+ insecurely load Dynamic Link Libraries (CWE-427) - CVE-2017-2246, CVE-2017-2248

  CVSS v3	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	Base Score: 7.8
  CVSS v2	AV:N/AC:M/Au:N/C:P/I:P/A:P	Base Score: 6.8

• Self-extracting archive files created by Lhaz or Lhaz+ insecurely load Dynamic Link Libraries (CWE-427) - CVE-2017-2247, CVE-2017-2249

  CVSS v3	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	Base Score: 7.8
  CVSS v2	AV:N/AC:M/Au:N/C:P/I:P/A:P	Base Score: 6.8

Impact

• Arbitrary code may be executed with the privilege of the user invoking the installer. - CVE-2017-2246, CVE-2017-2248
• Arbitrary code may be executed with the privilege of the user invoking the self-extracting archive file. - CVE-2017-2247, CVE-2017-2249

Solution

Update the software
Update to the latest version according to the information provided by the developer.